Data Privacy Expert - 4-5-Month Engagement

MENA Consultant; Riyadh; On-site; SAR 156,000 - 246,000; Full time

Job summary

MENA Consultant is seeking a Data Privacy Expert for a 4-5 month on-site engagement in Riyadh, Saudi Arabia. You will develop and oversee the data protection program to ensure PDPL compliance and align with SDAIA/NDMO controls.

Required are 3–5+ years in privacy, strong knowledge of data minimization, purpose limitation, and accountability, and experience with DPIAs and privacy-by-design.

Qualifications

• Knowledge of PDPL, NDMO, SDAIA standards and privacy regulations.
• Experience implementing and maintaining data protection policies, procedures, and standards.
• Experience conducting DPIAs and embedding privacy-by-design in projects.

Responsibilities

• Perform privacy compliance assessments and internal audits against PDPL and standards.
• Review processing activities for non-compliance and data risks; elevate issues.
• Maintain RoPA, data inventories, and data flow maps; support DPIAs and risk management.
• Assist with notices, consent mechanisms, and Data Subject Rights processes within timelines.
• Support privacy reviews of third-party/vendor engagements and DPAs.
• Provide guidance and training on privacy responsibilities across the organization.

Skills

Data privacy principles

DPIAs

Privacy-by-design

PDPL/NDMO/SDAIA standards

Privacy risk assessments

Data classification

Privacy management tools

Education

Bachelor’s degree in Law, Business, Computer Science, Information Management, Cybersecurity, or related field

Tools

Privacy management tools

Job description

Data Privacy Expert - 4-5-Month Engagement

Riyadh, KSA

Location: Riyadh, KSA.
Years of Experience: 3–5+ years of relevant experience.
Project Duration: 4-5 months.
Working Arrangement: on-site.
Language Requirements: Fluency in Arabic & English (written and spoken).

The Data Privacy Expert contributes to developing, implementing, and overseeing the organization's personal data protection program to ensure compliance with Saudi PDPL and its Implementing Regulations, while aligning with SDAIA and NDMO controls and international best practices. Under the direction of the Data Management Senior Director/Data Privacy Officer, the role protects personal and sensitive information, integrates privacy-by-design into data processing activities, and strengthens data protection awareness across the organization.

Key Requirements:

• 3–5+ years of relevant experience in data protection or data privacy.
• Solid knowledge of fundamental data privacy principles, including data minimization, purpose limitation, lawful basis, and accountability.
• Proven experience implementing and maintaining data protection policies, procedures, and standards, including conducting DPIAs and embedding privacy-by-design.
• Comprehensive understanding of PDPL, NDMO, and SDAIA standards.
• Experience performing privacy risk assessments, DPIAs, and audits.
• Familiarity with data classification and controls for protecting personal data.
• Familiarity with data privacy management tools.

Preferred Qualifications:

• Privacy certifications such as CIPM, CIPP/E, or equivalent; CDMP/DAMA.

Other Qualifications:

• Bachelor’s degree in Law, Business, Computer Science, Information Management, Cybersecurity, or a related field.
• Strong analytical reasoning and problem-solving abilities.
• Excellent communication and consulting skills.
• Effective collaboration across functions and engagement with stakeholders.
• Project management skills, attention to detail, and thorough documentation.

Key Responsibilities:

Compliance, Assessment & Audit:

• Perform regular privacy compliance assessments and internal audits against the PDPL, its Implementing Regulations, NDMO/SDAIA standards, and internal policies, recording findings and monitoring corrective actions.
• Review data processing activities to identify non-compliance or data handling risks and elevate significant issues to the Data Privacy Officer.
• Assist with investigations into potential personal data protection violations and maintain the register of compliance records relating to personal data protection.

Risk, DPIA & RoPA:

• Conduct regular privacy risk assessments to identify, evaluate, and mitigate potential privacy risks, maintaining the privacy risk register with clearly assigned owners and mitigation plans.
• Undertake and document Data Protection Impact Assessments (DPIAs) for new or modified processing activities, ensuring findings are recorded and incorporated into the organization’s risk management and data protection strategies.
• Keep the Record of Processing Activities (RoPA), personal data inventories, and data flow maps up to date as processing activities evolve, including data monetization initiatives.

Privacy Operations (Notices, Consent & Data Subject Rights):

• Assist in developing and maintaining privacy notices, transparency statements, and consent mechanisms that reflect actual processing purposes and legal bases, ensuring changes are communicated to data subjects.
• Support the implementation of processes for handling Data Subject Rights (DSR) requests—including access, correction, deletion, portability, and objection—within regulatory timelines.
• Assist with data breach detection, recording, and timely notification in accordance with the established breach management process and PDPL notification requirements, documenting evidence and lessons learned.

Third-Party & Cross-Border Processing:

• Support privacy reviews of third-party/vendor engagements and Data Processing Agreements (DPAs), including sub-processor and cross-border transfer controls aligned with PDPL statutory requirements.
• Participate in privacy risk assessments of prospective suppliers and assist with ongoing monitoring of processor and vendor compliance.

Awareness, Advisory & Regulatory Alignment:

• Provide guidance and training to relevant employees on their personal data protection responsibilities and support Privacy Champions across business units.
• Stay informed of developments in PDPL, NDMO, and SDAIA requirements to keep policies, procedures, and standards current, while assisting the Data Privacy Officer with SDAIA/NDMO coordination.
• Integrate privacy-by-design and data minimization principles into projects and system changes from the initial stages.